CVE-2026-120214— fastify/http-proxy 前缀逃逸漏洞
一分钟漏洞结论
影响对象
@fastify/http-proxy @fastify/http-proxy
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
是一个 Fastify 插件，用于将 HTTP 请求代理到配置前缀下的上游服务器。在 11.6.0 至 11.6.2 版本中，目标地址验证逻辑在百分号解码请求路径之前，先对字面反斜杠进行了规范化处理。因此，若攻击者将路径中的反斜杠和点段（dot-segments）进行编码，该路径便能绕过点段检查；而在检查通过后，这些编码会被解码为反斜杠和双点序列。当上游服务器运行在将反斜杠视为路径分隔符的平台上时，转发的请求便会跳出配置的代理前缀，访问到上游服务器上的同级目录位置。未认证的远程攻击者可利用此漏洞获取配置前缀之外的上
可能的 ATT&CK 技术 1 AI
T1190 · Exploit Public-Facing Application
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-120214 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
@fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments
来源: CVE Program / CVE List V5
Vulnerability Description
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and dot-segments survives the dot-segment check and is only turned into backslash and double-dot sequences after that check has passed. When the upstream resolves on a platform that treats a backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling location on the upstream. An unauthenticated remote attacker can use this to retrieve upstream resources outside the intended prefix, so the impact is confidentiality only, and exploitation depends on the upstream's path handling. The issue is fixed in @fastify/http-proxy 11.6.3, and users should upgrade to 11.6.3 or later. This is a follow-up to the earlier prefix-escape fix, which did not account for the encoded-backslash form.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| @fastify/http-proxy | @fastify/http-proxy | 11.6.0 ~ 11.6.3 | - |
|
二、漏洞 CVE-2026-120214 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-120214 的情报信息
请登录查看更多情报信息。